CVE-2019-14563 — Incorrect Conversion between Numeric Types in Linux

CWE-681 — Incorrect Conversion between Numeric Types CWE-787 — Out-of-bounds Write CWE-190 — Integer Overflow or Wraparound10 documents8 sources

Severity

7.8HIGHNVD

EPSS

0.1%

top 83.06%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Tianocore Edk2 Debian Linux

Timeline

PublishedNov 23

Latest updateMay 24

Description

Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

▶Debiantianocore/edk2< 0~20200229.4c0f6e34-1+3

Also affects: Debian Linux 9.0

🔴Vulnerability Details

GHSA

GHSA-5q44-mpwv-jf5p: Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access↗2022-05-24

▶

OSV

CVE-2019-14563: Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access↗2020-11-23

▶

CVEList

CVE-2019-14563: Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access↗2020-11-23

▶

📋Vendor Advisories

Ubuntu

EDK II vulnerabilities↗2020-04-30

▶

Red Hat

edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib↗2020-02-05

▶

Debian

CVE-2019-14563: edk2 - Integer truncation in EDK II may allow an authenticated user to potentially enab...↗2019

▶

💬Community

Bugzilla

CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [fedora-all]↗2020-02-10

▶

Bugzilla

CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [epel-all]↗2020-02-10

▶

Bugzilla

CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib↗2019-10-04

▶